ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-104003

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5.

Published Oct 15, 2026 · catalog updated Oct 16, 2026 · WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

Check if you run it

No confirmed exploitation is on record for CVE-2026-104003. EPSS is 0.23%. Act only if a listed version of WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.23%
Remediation
Version ranges on file
Affected products
stated Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · vendor properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · wordpress wp-user-avatar

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary shortcodes (from any active plugin or theme) with attacker-chosen attributes by posting a comment whose body contains the shortcode markup; the shortcode is then executed server-side when any visitor loads the target's front-end profile Comments tab, letting the attacker reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • stated Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress<= 4.17.5
  • vendor properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePressversion unspecified
  • wordpress wp-user-avatarversion unspecified

How to fix CVE-2026-104003

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-104003. EPSS is 0.23%. Act only if a listed version of WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress is installed.

Which versions are affected?

Compare what you have installed with Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-94: Code Injection. EPSS 0.23%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

WordPress security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · NIST NVD

    Detected

    The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pa

  2. Oct 16, 2026 · CVE.org

    Updated

    The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pa

Sources

  • CVE.orgVulnerability recordCVE-2026-104003

    The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts i

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-104003

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-104003

    The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts i

    nvd.nist.gov
  • Wordfence IntelligencePackage advisoryCVE-2026-104003

    The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts i

    wordfence.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.